Read the docs
TI-2026-29059 Aliases CVE-2026-40265GHSA-p5w6-75f9-cc2p

Note Mark has Broken Access Control on Asset Download

Priority MEDIUM 60CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset download endpoint at /api/notes/{noteID}/assets/{assetID} is registered without authentication middleware, and the backend query does not verify ownership or book visibility. An unauthenticated user who knows a valid note ID and asset ID can retrieve the full contents of private note assets without authentication, regardless of whether the associated book is public or private. This issue has been fixed in version 0.19.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00441 38th percentileScored 2026-11-07
Fix Fixed note-mark (enchant97): 0.19.2github.com/enchant97/note-mark/backend (Go): 0.0.0-20260411145023-6593898855ad

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
enchant97note-markbefore 0.19.20.19.2Patch availableCNA
—github.com/enchant97/note-mark/backend (Go)before 0.0.0-20260411145023-6593898855ad0.0.0-20260411145023-6593898855adPatch availableGHSA-p5w6-75f9-cc2p
  • note-mark Vendorenchant97 Affected before 0.19.2 Fixed in 0.19.2 Patch available CNA
  • github.com/enchant97/note-mark/backend (Go) Vendor— Affected before 0.0.0-20260411145023-6593898855ad Fixed in 0.0.0-20260411145023-6593898855ad Patch available GHSA-p5w6-75f9-cc2p

Remediation

  • Fix · CNA note-mark (enchant97) Fixed in 0.19.2
  • Fix · GHSA-p5w6-75f9-cc2p github.com/enchant97/note-mark/backend (Go) Fixed in 0.0.0-20260411145023-6593898855ad Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40265
  2. 2026-10-03 Alias added: GHSA-p5w6-75f9-cc2p

References

Advisory 1

Other 4

  • TI-2026-32452 Note Mark: JWT Secret Weakness allows Full Account Takeover via token forgery CVSS 3.1CRITICAL 10.0
  • TI-2026-30126 Note Mark: OIDC-registered users authenticated by submitting password "null" CVSS 3.1CRITICAL 9.4
  • TI-2026-29056 Note Mark has Stored XSS via Unrestricted Asset Upload CVSS 3.1HIGH 8.7
  • TI-2026-37275 Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p) CVSS 4.0HIGH 8.6
  • TI-2026-32451 Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leading to Remote Code Execution CVSS 4.0HIGH 8.6
  • TI-2026-37276 Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark CVSS 3.1MEDIUM 5.3
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences